<html>
<head><meta charset="utf-8"><title>cargo supply-chain · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html">cargo supply-chain</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="212178699"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212178699" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212178699">(Oct 03 2020 at 16:17)</a>:</h4>
<p>So I had an idea, and <span class="user-mention" data-user-id="229913">@HeroicKatora</span> was kind enough to prototype it: <a href="https://github.com/HeroicKatora/cargo-supply-chain/">https://github.com/HeroicKatora/cargo-supply-chain/</a><br>
It's a tool to list all the people you implicitly trust through the dependency tree - i.e. all the people with publishing permissions on <a href="http://crates.io">crates.io</a><br>
Right now it lists authors from <code>cargo metadata</code>, but I'm working on actual <a href="http://crates.io">crates.io</a> querying as we speak. I'll be moving this under secure-code-wg Github org shortly.</p>



<a name="212586028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212586028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212586028">(Oct 07 2020 at 16:42)</a>:</h4>
<p><a href="https://github.com/rust-secure-code/cargo-supply-chain">https://github.com/rust-secure-code/cargo-supply-chain</a><br>
It works! It actually works! And provides breakdowns both by owner and by crate.</p>



<a name="212586367"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212586367" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212586367">(Oct 07 2020 at 16:45)</a>:</h4>
<p>Any tips on how to make it a Cargo plugin, so it can be run as <code>cargo supply-chain</code> instead of <code>cargo-supply-chain</code>? I don't understand how <code>cargo geiger</code>, <code>cargo bloat</code>, <code>cargo audit</code> etc do that, and google search is failing me.</p>



<a name="212586510"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212586510" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212586510">(Oct 07 2020 at 16:46)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> you just put it in <code>PATH</code> and cargo will run it automatically if there's no builtin command with the same name</p>



<a name="212586535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212586535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212586535">(Oct 07 2020 at 16:46)</a>:</h4>
<p>but see <a href="#narrow/stream/246057-t-cargo/topic/Custom.20subcommand.20that.20can.20be.20used.20with.20or.20without.20cargo.3F">https://rust-lang.zulipchat.com/#narrow/stream/246057-t-cargo/topic/Custom.20subcommand.20that.20can.20be.20used.20with.20or.20without.20cargo.3F</a></p>



<a name="212586645"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212586645" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212586645">(Oct 07 2020 at 16:47)</a>:</h4>
<p>OIC, thanks!</p>



<a name="212587575"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212587575" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212587575">(Oct 07 2020 at 16:54)</a>:</h4>
<p>It works, yay! Thanks for the tip!</p>



<a name="212598250"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212598250" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212598250">(Oct 07 2020 at 18:17)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> neat. I do that stuff manually in <code>abscissa</code> today:</p>



<a name="212598314"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212598314" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212598314">(Oct 07 2020 at 18:18)</a>:</h4>
<p><a href="https://github.com/iqlusioninc/abscissa#depencencies">https://github.com/iqlusioninc/abscissa#depencencies</a></p>



<a name="212608354"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212608354" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212608354">(Oct 07 2020 at 19:33)</a>:</h4>
<p>In the course of this project I've unearthed a number of deficiencies in how <a href="http://crates.io">crates.io</a> handles access permissions:</p>
<ol>
<li>Github teams are black boxes, and the member list is impossible to obtain without an explicit OAuth permission.</li>
<li>Outstanding publisher invitations are impossible to list</li>
<li>Outstanding publisher invitations are impossible to revoke</li>
<li>Outstanding publisher invitations never expire</li>
</ol>



<a name="212609352"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212609352" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212609352">(Oct 07 2020 at 19:41)</a>:</h4>
<p>And until a few days ago that wasn't even properly tracked in the bug tracker. There are issues now:<br>
<a href="https://github.com/rust-lang/crates.io/issues/2868">https://github.com/rust-lang/crates.io/issues/2868</a><br>
<a href="https://github.com/rust-lang/crates.io/issues/2869">https://github.com/rust-lang/crates.io/issues/2869</a></p>



<a name="212609452"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212609452" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212609452">(Oct 07 2020 at 19:42)</a>:</h4>
<p>I wonder if I can assemble a project group to address it. How does one start a project group, again?</p>



<a name="212616813"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212616813" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212616813">(Oct 07 2020 at 20:45)</a>:</h4>
<p>asking #t-cargo seems like a start. I've had similar concerns, especially with proposals like <a href="https://github.com/rust-lang/crates.io/issues/326">https://github.com/rust-lang/crates.io/issues/326</a> which would further expand the complexity</p>



<a name="212617180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/212617180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#212617180">(Oct 07 2020 at 20:48)</a>:</h4>
<p>I feel that fixing invites is the easiest thing to do, so that's where we should start. I see <a href="http://crates.io">crates.io</a> team has their official channel on Discord, so I've asked there. Let's see if I can get anyone interested with the prospect of external contributors doing most of the work (I hope to get some from the tool announcement)</p>



<a name="226884881"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/226884881" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#226884881">(Feb 18 2021 at 21:36)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> this is something it might be interesting to add to future versions of <code>cargo supply-chain</code>: <a href="https://internals.rust-lang.org/t/making-crates-io-verify-code-against-repository/14075/2?u=bascule">https://internals.rust-lang.org/t/making-crates-io-verify-code-against-repository/14075/2?u=bascule</a></p>



<a name="237186004"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/237186004" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#237186004">(May 03 2021 at 16:07)</a>:</h4>
<p><code>cargo supply-chain</code> led to a conversation with the Rust Security Response team as well as the <a href="http://crates.io">crates.io</a> team. As a result, the issue with owner invitations on <a href="http://crates.io">crates.io</a> never expiring is now fixed: <a href="https://github.com/rust-lang/crates.io/issues/2869">https://github.com/rust-lang/crates.io/issues/2869</a><br>
I'm told the other issue posted above is being worked on.</p>



<a name="237186541"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/237186541" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#237186541">(May 03 2021 at 16:10)</a>:</h4>
<p>I've been working on <a href="https://github.com/rust-secure-code/cargo-supply-chain"><code>cargo supply-chain</code></a> again. The notable recent additions are:</p>
<ul>
<li>JSON output support</li>
<li>When downloading the cache, the download size is reduced from ~350Mb to ~60Mb</li>
<li>Nice progress bars instead of ad-hoc progress reporting or no feedback at all</li>
</ul>



<a name="237186718"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/237186718" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#237186718">(May 03 2021 at 16:12)</a>:</h4>
<p>I'm also considering adding a diff-friendly output mode.<br>
Regular:</p>
<div class="codehilite"><pre><span></span><code>The following crates will be ignored because they come from a local directory:
 - cargo-supply-chain

Using cached data. Cache age: 1 day

Dependency crates with the people and teams that can publish them to crates.io:

1. libc: team &quot;github:rust-lang:libc&quot;, team &quot;github:rust-lang:libs&quot;, JohnTitor, alexcrichton, gnzlbg, huonw, joshtriplett, rust-lang-owner
2. unicode-bidi: team &quot;github:servo:cargo-publish&quot;, SimonSapin, behnam, larsbergstrom, mbrubeck, metajack
3. core-foundation: team &quot;github:servo:cargo-publish&quot;, larsbergstrom, mbrubeck, metajack, pcwalton
...
</code></pre></div>
<p>Diff-friendly:</p>
<div class="codehilite"><pre><span></span><code>The following crates will be ignored because they come from a local directory:
 - cargo-supply-chain

Using cached data. Cache age: 1 day
adler: jonas-schievink
autocfg: cuviper, matklad
base64: alicemaz, marshallpierce
...
</code></pre></div>
<p>and everything other than the list of crates with owners goes to stderr, not stdout.</p>



<a name="237186787"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/cargo%20supply-chain/near/237186787" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/cargo.20supply-chain.html#237186787">(May 03 2021 at 16:13)</a>:</h4>
<p>PR for diff-friendly output: <a href="https://github.com/rust-secure-code/cargo-supply-chain/pull/62">https://github.com/rust-secure-code/cargo-supply-chain/pull/62</a><br>
<strong>I'd appreciate any thoughts on this.</strong> Good/bad idea? Better ways to do it?</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>